Analysis
- user interaction
yes - max time kernel
243s - max time network
246s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 03:10
General
- Target windhawk_setup.exe
- Size 11.0MB
- Sample260804-dn241a1cnd
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
Malware Config
Signatures
- Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}2⤵
-
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding2⤵
- Executes dropped EXE
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7719b04a-e645-4f12-93ed-695c9337b971 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c73be4ec-1c55-422c-bbba-03c3af0f65aa -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-226d7a61-379b-474c-bb2a-474a6ad5d4cb -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6152c158-713a-4e43-98f3-49551a61206e -LifetimeId:270d91c8-d2f3-4ddf-a479-0acad4cafc0b -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -check-for-updates2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe2⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS3⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /44⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"4⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkRunUITask /f5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkRunUITask /xml "C:\Users\Admin\AppData\Local\Temp\nsu325E.tmp\WindhawkRunUITask.xml"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /S /C "powershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff"5⤵
- Loads dropped DLL
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff6⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkUpdateTask /f5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkUpdateTask /xml "C:\Users\Admin\AppData\Local\Temp\nsu325E.tmp\WindhawkUpdateTask.xml"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService1⤵
- Executes dropped EXE
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Loads dropped DLL
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Executes dropped EXE
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
- Loads dropped DLL
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -service1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -tray-only2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Loads dropped DLL
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "C:\ProgramData\Windhawk\EditorWorkspace" --locale=en --no-sandbox --disable-gpu-sandbox2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1256,i,13964700044594470230,10514592798203264607,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --mojo-platform-channel-handle=1832 --field-trial-handle=1256,i,13964700044594470230,10514592798203264607,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2544 --field-trial-handle=1256,i,13964700044594470230,10514592798203264607,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:84079d2a-fcb3-4497-9783-c736e2463939 /prefetch:13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2796 --field-trial-handle=1256,i,13964700044594470230,10514592798203264607,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:e11421f6-04f5-474b-b1ae-3f64576b928e --vscode-window-kind=shared-process /prefetch:13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=ptyHost --logsPath C:\ProgramData\Windhawk\UIData\user-data\logs\20260804T0414064⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=fileWatcher4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --inspect-port=0 "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=extensionHost --skipWorkspaceStorageLock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=46164⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\Program Files\Windhawk\windhawk.exe"c:\Program Files\Windhawk\windhawk.exe" -new-updates-found4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1256,i,13964700044594470230,10514592798203264607,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:84079d2a-fcb3-4497-9783-c736e2463939 /prefetch:13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wsl.exeC:\Windows\Sysnative\wsl.exe --status3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
gcrt2.o
libc++.dll.a
libssp_nonshared.a
libc++.dll
libunwind.dll
gcrt1.o
libd3dcompiler_35.a
scardsrv.h
txctx.h
cfloat.inc
cfloat.inc
COPYING
gcrt2.o
libc++.modules.json
libd3dcompiler_35.a
libmapi32.a
libpthread.dll.a
COPYING.MinGW-w64-runtime.txt
COPYING.MinGW-w64.txt
COPYING.winpthreads.txt
COPYING.winstorecompat.txt
windhawk.dll
windhawk.dll
engine.ini
extension.js.LICENSE.txt
DO_NOT_EDIT.txt
processExplorer.js
letterpress-hcLight.svg
windhawk.exe
windhawk.ini
Windhawk.lnk
Windhawk.lnk~RFe5bda7e.TMP
settings.json
settings.json
settings.json
argv.json
extensions.json
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe5d14c3.TMP
the-real-index
the-real-index~RFe5c54ce.TMP
index.txt
index.txt~RFe5c54fd.TMP
CURRENT
index
the-real-index
the-real-index~RFe5c4d9b.TMP
MANIFEST-000001
storage.json
AccessControl.dll
ApplicationID.dll
INetC.dll
LangDLL.dll
SimpleSC.dll
System.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
default.exc
Windhawk.lnk
Windhawk.lnk~RFe5bda8e.TMP
WindhawkRunUITask
dberr.txt
memory/432-18086-0x0000000007040000-0x0000000007041000-memory.dmp
memory/596-18084-0x00000000392B0000-0x00000000392B1000-memory.dmp
memory/740-18077-0x0000000009400000-0x0000000009401000-memory.dmp
memory/940-18080-0x0000000008230000-0x0000000008231000-memory.dmp
memory/980-18082-0x00000000173F0000-0x00000000173F1000-memory.dmp
memory/1100-18088-0x0000000029720000-0x0000000029721000-memory.dmp
memory/1144-18114-0x000000001CB20000-0x000000001CB21000-memory.dmp
memory/1220-18090-0x0000000013980000-0x0000000013981000-memory.dmp
memory/1296-18092-0x0000000036140000-0x0000000036141000-memory.dmp
memory/1304-18166-0x0000000037DE0000-0x0000000037DE1000-memory.dmp
memory/1308-18094-0x000000003EB00000-0x000000003EB01000-memory.dmp
memory/1456-18096-0x0000000008EB0000-0x0000000008EB1000-memory.dmp
memory/1520-18098-0x0000000008230000-0x0000000008231000-memory.dmp
memory/1548-18100-0x000000003CAD0000-0x000000003CAD1000-memory.dmp
memory/1604-18102-0x0000000034A90000-0x0000000034A91000-memory.dmp
memory/1624-18104-0x00000000369B0000-0x00000000369B1000-memory.dmp
memory/1736-18106-0x0000000031340000-0x0000000031341000-memory.dmp
memory/1764-18116-0x0000000017680000-0x0000000017681000-memory.dmp
memory/1784-18108-0x0000000038680000-0x0000000038681000-memory.dmp
memory/1908-18110-0x0000000006790000-0x0000000006791000-memory.dmp
memory/2028-18112-0x0000000003B30000-0x0000000003B31000-memory.dmp
memory/2128-18118-0x00000000155D0000-0x00000000155D1000-memory.dmp
memory/2192-18120-0x000000001B5B0000-0x000000001B5B1000-memory.dmp
memory/2240-18122-0x0000000019EB0000-0x0000000019EB1000-memory.dmp
memory/2388-18124-0x0000000004360000-0x0000000004361000-memory.dmp
memory/2396-18126-0x000000000D3D0000-0x000000000D3D1000-memory.dmp
memory/2484-18128-0x00000000066A0000-0x00000000066A1000-memory.dmp
memory/2540-18130-0x000000000EFB0000-0x000000000EFB1000-memory.dmp
memory/2636-18132-0x0000000025ED0000-0x0000000025ED1000-memory.dmp
memory/2688-18134-0x0000000019020000-0x0000000019021000-memory.dmp
memory/2760-18136-0x0000000037060000-0x0000000037061000-memory.dmp
memory/2912-18138-0x0000000014360000-0x0000000014361000-memory.dmp
memory/2988-18140-0x00000000175D0000-0x00000000175D1000-memory.dmp
memory/3012-18142-0x0000000023380000-0x0000000023381000-memory.dmp
memory/3076-18144-0x0000000016070000-0x0000000016071000-memory.dmp
memory/3160-18146-0x0000000001C10000-0x0000000001C11000-memory.dmp
memory/3208-18164-0x000000002F380000-0x000000002F381000-memory.dmp
memory/3224-18148-0x000000003D3E0000-0x000000003D3E1000-memory.dmp
memory/3464-18150-0x000000002B4E0000-0x000000002B4E1000-memory.dmp
memory/3540-18152-0x000000001B370000-0x000000001B371000-memory.dmp
memory/3592-18154-0x000000002C450000-0x000000002C451000-memory.dmp
memory/3616-18156-0x000000003EFE0000-0x000000003EFE1000-memory.dmp
memory/3624-18158-0x000000003F890000-0x000000003F891000-memory.dmp
memory/3636-18160-0x0000000018240000-0x0000000018241000-memory.dmp
memory/3656-18162-0x000000001B3E0000-0x000000001B3E1000-memory.dmp
memory/3736-18058-0x00000000007D0000-0x00000000008EC000-memory.dmp
memory/4176-18178-0x000000000E4D0000-0x000000000E4D1000-memory.dmp
memory/4352-18168-0x0000000001900000-0x0000000001901000-memory.dmp
memory/4400-18170-0x000000000FD40000-0x000000000FD41000-memory.dmp
memory/4448-2-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-11-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-10-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-0-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-9-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-7-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-8-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4448-6-0x000001B0AFE60000-0x000001B0AFE61000-memory.dmp
memory/4452-18172-0x0000000038E70000-0x0000000038E71000-memory.dmp
memory/4568-18174-0x0000000015A20000-0x0000000015A21000-memory.dmp
memory/4740-18176-0x00000000292E0000-0x00000000292E1000-memory.dmp
memory/5068-18180-0x000000000DAE0000-0x000000000DAE1000-memory.dmp
memory/5176-18182-0x000000001C350000-0x000000001C351000-memory.dmp
memory/5212-18184-0x000000000A720000-0x000000000A721000-memory.dmp
memory/5276-18392-0x0000000008120000-0x000000000879C000-memory.dmp
memory/5276-18338-0x0000000003270000-0x00000000032A6000-memory.dmp
memory/5276-18377-0x00000000064D0000-0x0000000006536000-memory.dmp
memory/5276-18376-0x0000000005D50000-0x0000000005D72000-memory.dmp
memory/5276-18342-0x0000000005E80000-0x00000000064CA000-memory.dmp
memory/5276-18393-0x0000000006FE0000-0x0000000006FFA000-memory.dmp
memory/5276-18389-0x0000000006AF0000-0x0000000006B3C000-memory.dmp
memory/5276-18388-0x0000000006730000-0x000000000674E000-memory.dmp
memory/5276-18381-0x0000000006780000-0x0000000006ADB000-memory.dmp
memory/5276-18378-0x0000000006540000-0x00000000065A6000-memory.dmp
memory/5456-18186-0x0000000015A00000-0x0000000015A01000-memory.dmp